How to determine this is 403 blocked from Cloudflare (WAF/any firewall) or from Origin server?

How to determined this is 403 blocked from Cloudflare (WAF/any firewall) or from Origin server?

I want to know this blocked event from client-side to handle it. Did we have solid reponse header or some feature to enable it?

NNon How to determined this is 403 blocked from Cloudflare (WAF/any firewall) or from...

Chaika•3/20/25, 2:12 PM

If cf-cache-status exists, it's from origin

Chaika•3/20/25, 2:14 PM

The Cloudflare block pages are also very obviously cloudflare, ex: https://cloudflare.com/cdn-cgi/error/1006

NonOP•3/20/25, 2:42 PM

I want to check it via my client like iOS, Android application. So that html pages might be change over time cause CSS/redesign.

NonOP•3/20/25, 2:43 PM

Are you sure that

cf-cache-status

cf-cache-status

that will always hit from origin?

NonOP•3/20/25, 2:43 PM

I can't find any official document about it.

cf-cache-status

cf-cache-status

Chaika•3/20/25, 2:44 PM

cf-cache-status existing means the response came from the origin (cached or not), idk if I'd use it for automatic detection though, your app just shouldn't be blocked by your firewall in general

NNon I can't find any official document about it. `cf-cache-status`

Chaika•3/20/25, 2:44 PM

https://developers.cloudflare.com/cache/concepts/cache-responses/

NonOP•3/20/25, 2:45 PM

Yep, my app shouldn't blocked by my firewall. I want to reduce any false positive block events.

Thank you so much. I will try with

cf-cache-status

cf-cache-status

first.

NNon Yep, my app shouldn't blocked by my firewall. I want to reduce any false positiv...

Chaika•3/20/25, 2:46 PM

The alternative option, if you have control over your origin and it does respond with 403, is to check for a special header from it (or content type and then parse it)

Chaika•3/20/25, 2:47 PM

for example: if it's a 403 with non-json/non-parsable, assume Cloudflare, otherwise parse and show error from backend
if you have an API, you should carve out exceptions using Custom Rules though, don't block with Security Level, Bot Fight Mode (if you have it enabled, etc)

NonOP•3/20/25, 2:48 PM

That interesting..

I greatly appreciate your assistance; you've been incredibly helpful and provided valuable insights.

How to determine this is 403 blocked from Cloudflare (WAF/any firewall) or from Origin server?

Similar Threads

Similar Threads

Similar Threads